Re: The HTTP Origin Header (draft-abarth-origin)

On Mon, Jan 26, 2009 at 2:00 AM, Thomas Broyer <t.broyer@gmail.com> wrote:
> What if the UA discard the Origin value (i.e. use "null" or some other
> value) when crossing "zone" boundaries?

That's an interesting idea.  I'm not sure we have the notion of a
"zone" available to us at this level of abstraction.  Internet
Explorer certainly has that concept, but I'm not sure other browsers
do.

> When an Intranet web page issues a request to an Internet resource,
> then the UA SHOULD send "Origin: null" instead of "Origin:
> http://<intranet-server>".

We could recommend this in the non-normative privacy considerations
section.  It's certainly permitted by the current draft.

> Could it work? (I suppose this could be done based on which range the
> IP-address of the target resource belongs to, after DNS resolution;
> but maybe DNS resolution doesn't always happen depending on the proxy
> configuration –I don't know how this works)

I don't think we want to go about specifying this in detail.  We're
unlikely to get it right considering that IE let's the user configure
what sites are in which zones.

Adam